What a GMP Certificate Actually Tells You — And What It Doesn't

Ask a sourcing team whether a site is GMP compliant and you will usually get a yes or a no. Ask them how they know, and how long that answer stays true, and the conversation gets much shorter.

There is a good reason for that. A certificate of GMP compliance does not carry an expiry date. Not in the EU register, not in the UK one. The date you actually get is the date of the last inspection, and everything about current validity is inferred from it — by you, not by the regulator. Misreading that one detail is how a lapsed site ends up on an approved vendor list.

This guide covers what a GMP certificate proves, how to work out whether one is still current, why US and European evidence are not interchangeable, and what a statement of non-compliance means when you find one.

What the certificate actually says

A certificate of GMP compliance is issued by a national competent authority after it inspects a manufacturing site. It states that, at the time of that inspection, the site was found to comply with GMP principles for the operations listed on it.

Three things follow from that wording, and each one matters when you are qualifying a supplier.

It is a point-in-time finding, not a status. The certificate describes the state of the site on the inspection date. It is evidence about the past that we use to make an inference about the present.

It is scoped. Certificates list the specific operations covered — sterile manufacture, packaging, quality control testing, importation, and so on, often broken down by dosage form. A site certified for oral solid dose packaging is not thereby certified for aseptic fill-finish. Read the scope, not just the presence of a certificate.

It names a site, not a company. GMP is granted to a physical address. A supplier with five plants may hold certificates for two of them. The question is never "is this company GMP certified" — it is "is this site, for this operation, currently in compliance".

The expiry problem

Here is the part that trips people up. Open a certificate in EudraGMDP and look for a validity end date. There isn't one. The same is true of the MHRA register.

What the certificate says instead is a version of this:

This certificate reflects the status of the manufacturing site at the time of the inspection noted above and should not be relied upon to reflect the compliance status if more than three years have elapsed since the date of that inspection. However, this period of validity may be reduced or extended using regulatory risk management principles by an entry in the Restrictions or Clarifying remarks field.

So the working rule is inspection date plus three years — but with two important qualifications:

• That period can be shortened. A regulator applying risk-based principles may state a shorter validity in the remarks field.
• It can be extended, up to a maximum of five years in total, again by an entry in the remarks.

Which means any system that displays a GMP expiry date is showing you a derived figure, not a published one. That is fine, as long as everyone knows it is derived. It stops being fine when a derived date is presented as fact and nobody rechecks the remarks that might have moved it.

The practical discipline: treat the inspection date as the primary fact, because it is the only thing the regulator actually asserts. Use the three-year rule as a screening heuristic. Read the remarks before you rely on it for anything consequential.

US registration is not European certification

This is the other common conflation, and it has a measurable cost.

In the US, a manufacturing site that supplies the American market must register with the FDA. That registration is a real, checkable fact — it is how the FDA knows the site exists and what operations it performs. But registration is a notification, not a finding. The FDA does not issue GMP certificates in the European sense; compliance is established through inspection, and what surfaces publicly is usually the negative evidence — a Form 483, a warning letter, an import alert.

Europe works the other way round. The positive evidence is published: a certificate is issued and listed when a site passes inspection.

The two systems produce different artefacts, and a supplier can look strong in one and be invisible in the other. When we cross-referenced every FDA-registered API manufacturing site against the EU and UK certificate registers, fewer than one in five had a matching current GMP certificate. That is not because four in five are non-compliant. It is because they have never needed European certification — they serve the US market.

The lesson for a buyer is simple: check the register that matches your filing. If you are sourcing for an EU marketing authorisation, an FDA establishment registration does not answer your question, however impressive the site looks.

Statements of non-compliance

The mirror image of a certificate is a statement of GMP non-compliance, issued when an inspection finds serious deficiencies. These are rarer and far more informative than certificates, because they say what went wrong.

A non-compliance statement typically names the deficiencies, states the action the authority has taken — withdrawing an existing GMP certificate, suspending a manufacturing authorisation, restricting specific operations — and may include recall or risk-assessment commentary.

Two points on reading them:

• A non-compliance statement is not a certificate with a negative sign. It does not simply cancel out; it is a separate regulatory action with its own consequences, and any site carrying one deserves direct attention rather than a scoring adjustment.
• They are published for a reason. Regulators publish non-compliance findings so that other manufacturers can assess their own supply chains. If a site in your chain appears, that is an actionable signal, not background noise.

A practical checklist

When you evaluate GMP evidence for a site, work through these in order:

1. Which site? Confirm the certificate address matches the plant that will actually make your material, not the company headquarters or a sister facility.
2. Which operations? Check the scope covers what you need — dosage form, sterile or non-sterile, testing, packaging, importation.
3. When was the inspection? This is the primary fact. Anything older than three years needs justification.
4. Any remarks? Restrictions or clarifying remarks can shorten or extend validity, and they are free text — they have to be read, not parsed.
5. Which authority? Match the register to your target market. EU certificate for an EU filing; FDA registration and inspection history for the US.
6. Any adverse findings? Check for non-compliance statements, 483 observations, warning letters and recalls alongside the positive evidence.
7. How many alternatives? A perfectly certified single source is still a single source. Weigh it against your dual-sourcing position.

Why this is harder than it should be

None of the above is secret. It is difficult because the evidence is scattered: EU certificates in one register, UK in another, US registrations in a third, inspection outcomes in a fourth, and none of them share an identifier that lets you join a site across all four without careful matching.

That fragmentation is the actual work in supplier qualification, and it is the reason a question as simple as "is this site currently GMP certified, for the thing I need, in the market I am filing in" can take a quality team days to answer properly.

PharmaTek consolidates GMP certificates from the EU and UK registers, FDA establishment registrations, Drug Master Files and inspection history against a single company and site record — with the inspection date shown as the primary fact and derived validity labelled as derived. Search any manufacturer in the supplier directory, or see our analysis of where the world's APIs are actually made.